Malvertising involves injecting malicious or malware-laden advertisements into legitimate online advertising networks and webpages. Online advertisements provide a solid platform for spreading malware because significant effort is put into them in order to attract users and sell or advertise the product. Because advertising content can be inserted into high-profile and reputable websites, malvertising provides malefactors an opportunity to push their attacks to web users who might not otherwise see the ads, due to firewalls, more safety precautions, or the like. Malvertising is "attractive to attackers because they 'can be easily spread across a large number of legitimate websites without directly compromising those websites'." 
Malvertising is a fairly new concept for spreading malware and is even harder to combat because it can work its way into a webpage and spread through a system unknowingly: "The interesting thing about infections delivered through malvertising is that it does not require any user action (like clicking) to compromise the system and it does not exploit any vulnerabilities on the website or the server it is hosted from... infections delivered through malvertising silently travel through Web page advertisements."  It is able to expose millions of users to malware, even the most cautious, and is growing rapidly: "In 2012, it was estimated nearly 10 billion ad impressions were compromised by malvertising."  Attackers have a very wide reach and are able to deliver these attacks easily through advertisement networks. Companies and websites have had difficulty diminishing the number of malvertising attacks, which "suggests that this attack vector isn’t likely to disappear soon." 
How it works
Websites or web publishers unknowingly incorporate a corrupted or malicious advertisement into their page. Once the advertisement is in place, and visitors begin clicking on it, their computer can become infected: "the user clicks on the ad to visit the advertised site, and instead is directly infected or redirected to a malicious site. These sites trick users into copying viruses or spyware usually disguised as Flash files, which are very popular on the web."  Redirection is often built into online advertising, and this spread of malware is often successful because users expect a redirection to happen when clicking on an advertisement. A redirection that is taking place only needs to be co-opted in order to infect a user's computer.
Malvertising often involves the exploitation of trustworthy companies. Those attempting to spread malware place "clean" advertisements on trustworthy sites first in order to gain a good reputation, then they later "insert a virus or spyware in the code behind the ad, and after a mass virus infection is produced, they remove the virus", thus infecting all visitors of the site during that time period. The identities of those responsible are often hard to trace, making it hard to prevent the attacks or stop them altogether, because the "ad network infrastructure is very complex with many linked connections between ads and click-through destinations." 
Examples of malicious advertisements
Several popular websites and news sources have been victims to malvertising and have had malicious advertisements placed on their webpages or widgets unknowingly, including Horoscope.com, The New York Times, the London Stock Exchange, Spotify, and The Onion.
In 2009, the banner feed of The New York Times was hacked for the weekend of September 11 to 14, causing some readers to see advertisements telling them their systems were infected and trying to trick them into installing infected software on their computers. According to spokeswoman Diane McNulty, "the culprit approached the newspaper as a national advertiser and had provided apparently legitimate ads for a week", and the ads were switched to the virus alert malvertisement afterwards. The New York Times suspended third-party advertisements to address the problem, and even posted advice for readers regarding this issue on its technology blog.
Types and modes
By visiting websites that are affected by malvertising, users are at risk of infection. There are many different methods used for injecting malicious advertisements or programs into webpages:
- Pop-up ads for deceptive downloads, such as fake anti-virus programs that install malicious software on the computer
- In-text or in-content advertising
- Drive-by downloads
- Web widgets in which redirection can be co-opted into redirecting to a malicious site
- Hidden iframes that spread malware into websites
- Content delivery networks exploited to share malware
- Malicious banners on websites
- Third-party advertisements on webpages
- Third-party applications, such as forums, help desks, and customer relationship management and content management systems
There are several precautions that people can take to lessen their chances of getting tricked by these advertisements. Besides just learning about them, users can download internet browsers that can detect websites that have malware advertisements on them, such as Internet Explorer 9 or Google Chrome, which "includes some security advances that make attacks more difficult." Commonly used programs such as Adobe Flash Player and Adobe Reader can have their flaws exploited, and become vulnerable to attacks, so it is important to keep them up to date. Users can use ad blockers such as Adblock Plus or AdBlock to prevent running any code, including legitimate advertising, from known ad networks. Users can also download anti-virus software that protects against threats and removes malicious software from their systems. Users can also push companies and websites to scan advertisements before making them active on their webpages.
- William Salusky (2007-12-06). "Malvertising". SANS ISC. Retrieved 2010-08-05.
- Online Trust Alliance (2012-07-29). "Anti-Malvertising Resources". Online Trust Alliance. Retrieved 2013-05-25.
- Sood, Aditya; Enbody, Richard (April 2011). "Malvertising - exploiting web advertising" (PDF). Computer Fraud and Security: 11–16. Retrieved 26 February 2013.
- Bobbie Johnson (25 September 2009). "Internet companies face up to 'malvertising' threat". The Guardian. Retrieved 2010-08-05.
- "The rise of malvertising and its threat to brands". Deloitte. 2009.
- Zeltser, Lenny. "Malvertising: Some Examples of Malicious Ad Campaigns". Lenny Zeltser on Information Security. Retrieved 22 March 2013.
- "Five-month malvertising campaign serves up silent infections". Infosecurity. Reed Exhibitions. Retrieved 18 March 2013.
- "A rising security threat: Malvertising". Bullguard. Retrieved 18 March 2013.
- Johnson, Bobbie (Sep 25, 2009). "Internet companies face up to 'malvertising' threat". The Guardian. Retrieved 26 February 2013.
- Picchi, Aimee (14 September 2009). "Malvertising hits The New York Times". The Daily Finance. Retrieved 26 February 2013.
- Finley, Klint. "Report: The 3 Biggest Enterprise Website Malware Vulnerabilities". Readwrite Enterprise. SAY Media. Retrieved 22 March 2013.
- Richmond, Riva. "Five Ways to Keep Online Criminals at Bay". Personal Tech. The New York Times. Retrieved 26 February 2013.